Flexible Policy-Directed Code Safety. - David E. Evans 001; Andrew Twyman (S&P, 1999)